<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 4, 2016, at 1:06 PM, <a href="mailto:zaki@manian.org" class="">zaki@manian.org</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">It appears Ofek got the help he needed here.<br class=""><a href="https://github.com/pyca/cryptography/pull/3287" class="">https://github.com/pyca/cryptography/pull/3287</a><br class=""></div></div></blockquote><div><br class=""></div><div>I’m responsible for that (hopefully not too terrible given the use case) explanation. The SECG document just has the high-level description in terms of Z=Y/X, but doesn’t seem to mention Frobenius, trace or half-trace in that section. (I haven’t read the rest of the document to see if they eventually do; I’m currently traveling but will be skimming that later. A quick search seems to suggest the string Frobenius does not occur in that document.)</div><div><br class=""></div><div>If anyone has any good documentation for how you actually _implement_ that (in code, not just the mathematical derivation), I’d be much obliged; even if it’s only a way to check my work. OpenSSL has an implementation but it’s very OpenSSL so perhaps not the best for instruction; looks like Golang only implements P-x curves, and not the SECG F2^m curves. (I found a Golang implementation on GitHub, but I’m less likely to trust it than the Golang stdlib, and it didn’t implement point compression.)</div><div><br class=""></div><div>On a related note: how bad would it be to have a “default” compression for these curves? My understanding is that there are a few options, and while I’ve never seen anything but the SECG method for the SECG curves, I don’t know if the other compression methods are often used in the wild for these or other F2^m curves.</div><div><br class=""></div><div>lvh</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="gmail_quote"><div dir="ltr" class="">On Sat, Dec 3, 2016 at 6:08 PM Ofek Lev <<a href="mailto:ofekmeister@gmail.com" class="">ofekmeister@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="gmail_msg"><div style="font-size:12.8px" class="gmail_msg">I understand for prime curves it is just `bytes(0x02 + flag) + bytes(x)` where flag is the LSB of y. For the F2m curves I cannot make out how to do it.</div><div style="font-size:12.8px" class="gmail_msg"><br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><a href="http://grouper.ieee.org/groups/1363/IBC/material/P1363.3-D1-200805.pdf%20section%205.6.6.1.2" class="gmail_msg" target="_blank">IEEE P1363</a> section 5.6.6.1.2 appears to say flag is '1 if y of point > y of inverse point else 0' which I think just means `if y > x`.<br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><a href="http://cs.ucsb.edu/~koc/ccs130h/projects/03-ecc-protocols/Julio_Slides.pdf" class="gmail_msg" target="_blank">these slides</a> (slide 15) by Julio Lopez and Ricardo Dahab appear to suggest my interpretation of the IEEE method is off (I think).<br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><a href="http://www.secg.org/sec1-v2.pdf%20section%202.3.3%20part%202.2.2" class="gmail_msg" target="_blank">http://www.secg.org/sec1-v2.pdf</a> (which I think is the standard reference) section 2.3.3 part 2.2.2 has yet another notation that I do not understand.<br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg"><br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg">I was told there are multiple ways. Can someone please explain the most *standard* (or easiest) way requiring size <span style="font-size:12.8px" class="gmail_msg">m + 1</span><span style="font-size:12.8px" class="gmail_msg">, preferably from a programmer's perspective? This math is beyond me :)</span></div><div style="font-size:12.8px" class="gmail_msg"><br class="gmail_msg"></div><div style="font-size:12.8px" class="gmail_msg">Any insight would be greatly appreciated.</div></div> _______________________________________________<br class="gmail_msg"> Curves mailing list<br class="gmail_msg"> <a href="mailto:Curves@moderncrypto.org" class="gmail_msg" target="_blank">Curves@moderncrypto.org</a><br class="gmail_msg"> <a href="https://moderncrypto.org/mailman/listinfo/curves" rel="noreferrer" class="gmail_msg" target="_blank">https://moderncrypto.org/mailman/listinfo/curves</a><br class="gmail_msg"> </blockquote></div></div> _______________________________________________<br class="">Curves mailing list<br class=""><a href="mailto:Curves@moderncrypto.org" class="">Curves@moderncrypto.org</a><br class="">https://moderncrypto.org/mailman/listinfo/curves<br class=""></div></blockquote></div><br class=""></div></body></html>